Checkermax report has identified Client DOM XSS issue for the input parameter whose value is in the format of !caselst.casenumber

Here caselst is the variable for the list of cases. List of cases are returned from the apex method and stored in an attribute which is iterated in aura component. Casenumber is targeted as not properly sanitized.

I need help in how to sanitize this and the reason as why this is captured under Client DOM XSS issue ?

<td class = "slds-cell-wrap" > 
  <lightning:input aura:id="inputselect" type="radio" name="{!caselst.Id}" value="{!caselst.CaseNumber}" onchange="{!c.changeradio}"/> 

1 Answer 1


That's a false positive. XSS is impossible in this scenario. In Salesforce, only Visualforce is susceptible to XSS injection, while in Aura and LWC, attributes are automatically escaped/sanitized as necessary to avoid any possible injection.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .